Bug Fixes

• authentication-oauth: validate redirects for a relative oauth.redirect (1f1e4b3)

5.0.52 (2026-10-28)

Bug Fixes

• authentication-oauth: keep the OAuth token in the redirect fragment (4c8650c)
• knex: omit queries from all database error messages (#3725) (f300461), closes #3711 #3711

5.0.51 (2026-10-25)

Bug Fixes

• authentication-oauth: allow account linking from the configured oAuth origin (616e885)
• authentication-oauth: harden OAuth callback and profile handling (3673cde)
• authentication-oauth: only link accounts from an allowed origin (1c29862)
• generators: use entity camelName for auth params in schema templates (#3706) (05bb6c8)
• schema: recheck external dispatch after resolving (#3705) (572574e)

5.0.50 (2026-09-11)

Bug Fixes

• core: Set version back to development (ab6f0eb)
• transport-commons: map HEAD requests like GET for REST services (#3701) (fcbf602)
• Update dependencies (#3703) (4dd36da)

5.0.49 (2026-08-14)

Bug Fixes

• adapter-commons: validate query operators nested in arrays (#3700) (304a1aa)

5.0.48 (2026-08-11)

Bug Fixes

• authentication-oauth: allow any port on loopback OAuth origins (#3699) (1a58896), closes #3684

5.0.47 (2026-08-10)

Note: Version bump only for package @feathersjs/feathers

Crow republish: correct compiled builds

Bug Fixes

• release: Republish Crow packages with correctly compiled lib/ from crow source. v4.5.20 accidentally shipped stale Dove builds for some packages (notably @feathersjs/adapter-commons exported AdapterBase instead of AdapterService), which broke feathers-memory and CI.

Notes

• Still includes the @feathersjs/commons prototype-pollution fix from #3695 / GHSA-28xv-ph75-77wh.
• Prefer 4.5.21 over 4.5.20 for all Crow packages.
• prepublishOnly added so modern npm recompiles before publish.

All packages published with dist-tag crow.

@feathersjs/commons@4.5.20 (Crow)

Bug Fixes

• commons: skip prototype-polluting keys in _.merge (#3695)

Backport of GHSA-28xv-ph75-77wh / CVE-2026-54335 (Dove fix: #3690 / 5.0.45).

All Crow packages published as 4.5.20 with dist-tag crow.

5.0.46 (2026-06-27)

Bug Fixes

• mongodb: let objectid keyword fail validation (#3691) (4e312b4)
• Update all dependencies (#3692) (d7e4cc9)